Story image

Online businesses under siege from botnet DDoS attacks and credential abuse – report

04 Jul 2018

Cybersecurity defenders face increasing threats from organisations in the form of bot-based credential abuse targeting the hospitality industry and advanced distributed denial of service (DDoS) attacks.

This is according to the Summer 2018 State of the Internet / Security: Web Attack report released by cloud delivery platform Akamai Technologies.

Analysis of current cyberattack trends for the six-month period from November 2017 through April 2018 reveals the importance of maintaining agility not only by security teams but also by developers, network operators and service providers in order to mitigate new threats.

Hospitality industry vs. bots: Analysis of fraud attempts 

The use of bots to abuse stolen credentials continues to be a major risk for Internet-driven businesses, but data from this report reveals that the hospitality industry experiences many more credential abuse attacks than other sectors.

Akamai researchers analysed nearly 112 billion bot requests and 3.9 billion malicious login attempts that targeted sites in this industry including airlines, cruise lines and hotels among others.

Nearly 40% of the traffic seen across hotel and travel sites is classified as "impersonators of known browsers", which is a known vector for fraud.

Geographic analysis of attack traffic origination reveals that Russia, China and Indonesia were major sources of credential abuse for the travel industry during the period covered by the report, directing about half of their credential abuse activity at hotels, cruise lines, airlines, and travel sites.

Attack traffic origination against the hospitality and travel industry from China and Russia combined was three times the amount of attacks originating in the US.

"These countries have historically been large centres for cyberattacks, but the attractiveness of the hospitality industry appears to have made it a significant target for hackers to carry out bot-driven fraud," says Akamai senior security advocate and State of the Internet / Security report senior editor Martin McKeay.

The rise of advanced DDoS attacks highlights need for security adaptability 

While simple volumetric DDoS attacks continued to be the most common method used to attack organisations globally, other techniques have continued to appear.

For this edition of the report, Akamai researchers identified and tracked advanced techniques that show the influence of intelligent, adaptive enemies who change tactics to overcome the defences in their way.

One of the attacks in the report came from a group that coordinated their attacks over group chats on STEAM and IRC.

Rather than using a botnet of devices infected with malware to follow hacker commands, these attacks were carried out by a group of human volunteers.

Another notable attack overwhelmed the target’s DNS server with bursts lasting several minutes instead of using a sustained attack against the target directly.

This added to the difficulty of mitigating the attack due to the sensitivity of DNS servers, which allows outside computers to find them on the Internet.

The burst system also increased difficulty by fatiguing the defenders over a long period of time.

"Both of these attack types illustrate how attackers are always adapting to new defences to carry out their nefarious activities," says McKeay.

"These attacks, coupled with the record-breaking 1.35 Tbps memcached attacks from earlier this year, should serve as a not-so-gentle reminder that the security community can never grow complacent."

Other highlights from Akamai’s Summer 2018 State of the Internet / Security: Web Attack report include:

  • Akamai measured a 16% increase in the number of DDoS attacks recorded since last year.
  • The largest DDoS attack of the year set a new record at 1.35 Tbps by using the memcached reflector attack.
  • Researchers identified a 4 percent increase in reflection-based DDoS attacks since last year.
  • There was a 38 percent increase in application-layer attacks such as SQL injection or cross-site scripting.
  • In April, the Dutch National High Tech Crime Unit took down a malicious DDoS-for-hire website with 136,000 users.
Survey: IT pros nostalgic over on-prem data centre visibility
There are significant security and monitoring challenges faced by IT staff responsible for managing public and private cloud deployments.
61% of CIOs believe employees leak data maliciously
Egress conducted a survey to examine the root causes of employee-driven data breaches, their frequency, and impact.
Opinion: BYOD can be secure with the right measures
Companies that embrace BYOD are giving employees more freedom to work remotely, resulting in increased productivity, cost savings, and talent retention.
Sonatype and HackerOne partner on open source vulnerability reporting
Without a standard for responsible disclosure, even those who want to disclose vulnerabilities responsibly can get frustrated with the process.
OutSystems and Boncode team up for better code analysis
The Boncode and OutSystems alliance aims to help organisations to build fast and feel comfortable that the work they're delivering is at peak quality levels.
Nuance biometrics fight back against fraud
Nuance Communications has crunched the numbers and discovered that it has prevented more than US$1 billion worth of fraud from being passed on to users of its Nuance Security Suite.
SIS announces a partnership with Platform 4
“We are looking forward to a strong future in the New Zealand security industry with this global giant as our strategic partner."
Attacks targeting Cisco Webex extension explode in popularity - WatchGuard
WatchGuard's Internet Security Report for Q4 2018 also finds growing use of a new sextortion phishing malware customised to individual victims.